Skip to content
OpenAdvisories
Medium ALAS2-2022-1820 1 CVE

Moderate: git security update (Amazon Linux 2)

Published Jul 19, 2022 · Updated Jul 20, 2022

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-29187: A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This issue allows the owner of the repository to cause arbitrary commands to be executed by other users who access the repository.

Fixed packages 18

ReleasePackageFixed in
Amazon Linux · 2 git 0:2.37.1-1.amzn2.0.1
Amazon Linux · 2 git-all 0:2.37.1-1.amzn2.0.1
Amazon Linux · 2 git-core 0:2.37.1-1.amzn2.0.1
Amazon Linux · 2 git-core-doc 0:2.37.1-1.amzn2.0.1
Amazon Linux · 2 git-credential-libsecret 0:2.37.1-1.amzn2.0.1
Amazon Linux · 2 git-cvs 0:2.37.1-1.amzn2.0.1
Amazon Linux · 2 git-daemon 0:2.37.1-1.amzn2.0.1
Amazon Linux · 2 git-debuginfo 0:2.37.1-1.amzn2.0.1
Amazon Linux · 2 git-email 0:2.37.1-1.amzn2.0.1
Amazon Linux · 2 git-gui 0:2.37.1-1.amzn2.0.1
Amazon Linux · 2 git-instaweb 0:2.37.1-1.amzn2.0.1
Amazon Linux · 2 git-p4 0:2.37.1-1.amzn2.0.1
Amazon Linux · 2 git-subtree 0:2.37.1-1.amzn2.0.1
Amazon Linux · 2 git-svn 0:2.37.1-1.amzn2.0.1
Amazon Linux · 2 gitk 0:2.37.1-1.amzn2.0.1
Amazon Linux · 2 gitweb 0:2.37.1-1.amzn2.0.1
Amazon Linux · 2 perl-Git 0:2.37.1-1.amzn2.0.1
Amazon Linux · 2 perl-Git-SVN 0:2.37.1-1.amzn2.0.1

Vulnerabilities 1

  • High 7.8
    CVE-2022-29187

    Bypass of safe.directory protections in Git

    Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An unsuspecting user could still be affected by the issue reported …

    git git git git Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-29187.html